Security readout for executives and security teams
Plain-English summary
A Linux kernel MMC firmware-update path can access memory before an array when handling its first entry. Kernel memory errors can potentially affect the entire system, explaining the high severity. The supplied evidence indicates a local attack surface, not remote internet exposure, and does not establish active exploitation.
Executive priority
Treat this as high-priority kernel maintenance rather than an internet-wide emergency. Accelerate assessment for embedded, appliance, industrial, and other MMC-dependent systems, especially where less-trusted users or processes have local access. Use normal expedited patch governance unless vendor-specific evidence indicates greater urgency.
Technical view
The MMC core close-ended FFU logic assigned prev_idata from idatas[i-1] without ensuring i was greater than zero. At i=0, this becomes a negative array index. The correction adds the missing bounds check. CVSS 3.1 is 7.8, reflecting local, low-privilege, low-complexity potential for high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Linux kernel builds containing the regression and capable of reaching the affected MMC FFU path. Systems using MMC storage deserve priority. The flattened version data supplied here does not preserve sufficiently clear range semantics, so displayed kernel versions alone should not determine vulnerability.
Exploitation context
The CVSS vector describes a local attacker with low privileges, low complexity, and no required user interaction. CVE-2024-35813 is not listed as KEV in the supplied bundle, and none of the provided sources establishes public exploitation, a proof of concept, or exploitation in the wild.
Researcher notes
The source establishes an idatas[i-1] access at i=0 and a bounds-check correction. It does not establish the precise triggering prerequisites, a reliable exploitation primitive, or observed attacks. The supplied affected-version representation mixes commits, releases, and default statuses without complete range semantics; validate against full vendor records and backport history.
Mitigation direction
- Apply supported vendor kernel updates incorporating the cited upstream correction.
- Consult distribution or device-vendor advisories for backport and package-specific status.
- Prioritize systems using MMC storage or related firmware-update functionality.
- If updates are delayed, reduce unnecessary local account access where operationally feasible.
Validation and detection
- Inventory running kernel builds, package revisions, and systems using MMC storage.
- Map each build to vendor advisories or source commits, not only its displayed kernel version.
- Confirm the regression is absent or a cited corrective commit has been backported.
- After updating, reboot and verify the corrected kernel is actually running.
- Track systems whose vendors have not published a clear vulnerability determination.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35813 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b9a7339ae403035ffe7fc37cb034b36947910f68CVE reference, Linux
- https://git.kernel.org/stable/c/2b539c88940e22494da80a93ee1c5a28bbad10f6CVE reference, Linux
- https://git.kernel.org/stable/c/81b8645feca08a54c7c4bf36e7b176f4983b2f28CVE reference, Linux
- https://git.kernel.org/stable/c/ad9cc5e9e53ab94aa0c7ac65d43be7eb208dcb55CVE reference, Linux
- https://git.kernel.org/stable/c/4466677dcabe2d70de6aa3d4bd4a4fafa94a71f2CVE reference, Linux
- https://git.kernel.org/stable/c/064db53f9023a2d5877a2d12de6bc27995f6ca56CVE reference, Linux
- https://git.kernel.org/stable/c/7d0e8a6147550aa058fa6ade8583ad252aa61304CVE reference, Linux
- https://git.kernel.org/stable/c/cf55a7acd1ed38afe43bba1c8a0935b51d1dc014CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.